Notifications
Clear all
Topic starter
02/08/2026 11:41 am
TL;DR: A new npm supply-chain compromise targeting SAP developer packages used a preinstall hook, a Bun loader, and an 11.7 MB payload to steal GitHub, npm, cloud, and Kubernetes secrets before exfiltrating encrypted data through public repositories, according to Aikido. The real issue is not just malware in packages, but the speed with which stolen non-human credentials can turn build systems into propagation infrastructure.
NHIMG editorial — based on content published by Aikido: Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes - and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do exposed secrets in CI/CD pipelines create such a large blast radius?
A: CI/CD systems often hold cloud credentials, deployment tokens, and repository access in the same execution context.
Q: How do security teams know whether NHI provisioning is actually governed?
A: Look for three signals: every identity has an owner, every secret lands in an approved storage path, and every new object appears immediately in inventory and lifecycle workflows.
Practitioner guidance
- Block install-time execution in high-risk repositories Restrict or inspect npm lifecycle scripts such as preinstall in CI and release pipelines, especially where package installs can access secrets, tokens, or cloud metadata.
- Rotate every secret touched by package compromise If a malicious dependency was installed, rotate GitHub tokens, npm tokens, cloud provider keys, Kubernetes service account tokens, and any CI secrets that were present on the affected host or runner.
- Separate build identities from developer identities Use dedicated build accounts with narrowly scoped permissions, short lifetimes, and isolated secret stores so a compromised workstation cannot directly access release or cloud control planes.
What's in the full analysis
Aikido's full post covers the operational detail this post intentionally leaves for the source:
- File-level indicators of compromise, including the malicious setup.mjs and execution.js artifacts.
- The exact GitHub commit markers and repository naming patterns used for exfiltration and propagation.
- Step-by-step detection logic for identifying affected packages in lockfiles, caches, CI logs, and internal registries.
- Manual rescan and rotation guidance for environments that may have executed the malicious install path.
👉 Read Aikido's analysis of Mini Shai-Hulud and SAP npm package compromise →
Mini Shai-Hulud and SAP npm packages: what IAM teams need to know?
Explore further
02/08/2026 12:53 pm
Secret sprawl is now an identity-risk problem, not just a hygiene problem. This campaign shows how package managers, CI runners, and developer workstations have become repositories of reusable non-human identities. When tokens, service accounts, and cloud credentials sit across multiple execution surfaces, compromise of one package can expose the governance gap between software supply chain security and identity lifecycle control. The practical conclusion is that secret governance must be treated as identity governance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when a supply chain package steals credentials and machine access?
A: Accountability usually sits across engineering, platform security, and identity teams because the failure spans software intake, endpoint execution, and credential governance. The right control owners are the teams that approve package trust, manage secret lifecycles, and define which identities may exist on developer workstations.
👉 Read our full editorial: Mini Shai-Hulud shows how npm supply chain malware steals NHI secrets
